Is Allow Copy + safe?
Allow Copy + is medium risk. A content script on allowcopyplus.pidevex.com, the dev's own site opened after install, relays a postMessage to the worker, which checks origin/ID then returns activation history: hostnames, counts/dates, an ID; sent in the install URL.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Developer's Website Can Read Your Activation History via postMessage
A content script on allowcopyplus.pidevex.com, the dev's own site opened after install, relays a postMessage to the worker, which checks origin/ID then returns activation history: hostnames, counts/dates, an ID; sent in the install URL.
You visit the developer's own website, allowcopyplus.pidevex.com, including the walkthrough page the extension opens automatically right after installation.
A content script the extension injects on that site relays a postMessage to the service worker, which reads your activation history from storage and posts it back to the page.
The reply includes every hostname where you've turned the extension on or off, your on/off counts and their dates, and a persistent per-install ID, all readable by JavaScript running on the developer's page.
| Field | Value | Why it matters | |
|---|---|---|---|
Sites where extension was activated | github.com, docs.google.com, mail.example.com (illustrative — the real list reflects your own activation history) | Every hostname you've turned Allow Copy + on for is sent as a list, letting the page infer which sites you use it on. | |
Activation/deactivation counts and dates | {"activateCount":4,"deactivateCount":1,"lastActivateDate":"2026-07-02T09:14:00.000Z"} (illustrative — the real object reflects your own activation history) | How many times you've turned the extension on and off, plus the timestamps of your most recent activate and deactivate. | |
Persistent install ID | a1b2c3d4-5e6f-4a1b-9c2d-3e4f5a6b7c8d (illustrative — a real UUID generated at install) | A UUID generated once at install and never rotated, letting the site recognize your browser as the same visitor across separate site visits. |
The postMessage bridge as shipped vs. annotated
// Content script injected on https://allowcopyplus.pidevex.com/*
window.addEventListener('message', async (event) => {
// Only accepts requests whose page origin is the developer's own site...
if (event.origin === new URL(WEB_SITE_URL).origin &&
event.data?.type === 'EXT_GET_STAT') {
// ...then forwards whatever the page sent as the request body
const request = { type: 'WS_GetStat', data: event.data };
chrome.runtime.sendMessage(request).then((response) => {
if (response?.isSuccess) {
// Posts the extension's reply straight back to the page
window.postMessage({
type: 'EXT_RESP_STAT',
stat: response.data.stat,
extId: response.data.extId,
created: new Date().toISOString(),
}, new URL(WEB_SITE_URL).origin);
}
});
}
});// Service worker message handler
case 'WS_GetStat': {
let result = { isSuccess: false };
// Gate: sender's page origin must be the developer's site, AND the
// extId in the request must equal this install's own runtime ID.
if (sender.origin === new URL(WEB_SITE_URL).origin &&
message.data?.extId === getExtId()) {
await chrome.storage.sync.get().then((store) => {
result = {
isSuccess: true,
data: {
extId: getExtId(),
created: new Date().toISOString(),
stat: {
stat: store[ACTIVATION_STAT_KEY], // activate/deactivate counts + dates
inst: store[INSTANCE_KEY], // persistent per-install UUID
domains: store[DOMAINS_KEY], // every hostname you've toggled the extension on
},
},
};
}).catch(() => { result = { isSuccess: false }; });
}
sendResponse(result);
break;
}Reproduces the postMessage handshake so you can see, in your own browser, exactly what activation data the extension discloses to this page.
// allowcopyplus-stat-reveal.js
// Run this in the DevTools console while visiting https://allowcopyplus.pidevex.com
// with "Allow Copy +" installed. It reproduces the handshake the page's own
// script performs, and logs whatever the extension discloses back to the page.
// 1. Find the extension's runtime ID. The extension discloses this itself: it
// opens https://allowcopyplus.pidevex.com/how-to-use?ext_id=<RUNTIME_ID> right
// after install, so a script on this origin can read it from location.href on
// that first visit. If you're not on that URL, grab RUNTIME_ID from
// chrome://extensions (enable Developer mode, copy the ID) and paste it below.
const RUNTIME_ID = new URLSearchParams(location.search).get('ext_id') || '<paste runtime id here>';
// 2. Listen for the extension's reply before sending the request.
window.addEventListener('message', (event) => {
if (event.origin !== location.origin) return;
if (event.data?.type !== 'EXT_RESP_STAT') return;
console.log('Extension disclosed:', event.data);
}, { once: true });
// 3. Send the handshake the extension's own content script listens for.
window.postMessage({ type: 'EXT_GET_STAT', extId: RUNTIME_ID }, location.origin);
- 1Paste into the DevTools console on https://allowcopyplus.pidevex.com with Allow Copy + installed, then press Enter.
- allowcopyplus.pidevex.com
The developer's own site (PiDevEx/Allow Copy +), opened after install with the runtime ID in the URL, letting it request your activation history via postMessage later.